Matt Brown

Principal Consultant @ Brown Fine Security | IoT Security Researcher | Soli Deo Gloria

[Matt Brown @nmatt0]

My research got featured on @WIRED today 😀

[WIRED @WIRED]

Misconfigured license plate recognition systems reveal the livestreams of individual cameras and the wealth of data they collect about every vehicle that passes them by. https://t.co/5FeU1j8MOD

[Iceman @herrmann1001]

https://t.co/KudyVpzyyJ

That went fast.

[Matt Brown @nmatt0]

@SamuraiShibaJP Virginia to Iowa in a day. 14 hours.

[Matt Brown @nmatt0]

I need this to keep the youths off my lawn.

[Min Choi @minchoi]

China's Unitree just dropped H2-X Kung Fu Legend Guardian.

Dents car doors. 4 meter drops. Spinning kicks + flips. Even lifts front of a car.

We are cooked 💀

[Matt Brown @nmatt0]

Firmware scanning tool Mithril can now detect eMudhra style EC key flaws as well as many other weak key issues with the --keys flag!

https://t.co/tdqGgU5lCv

Remember to unpack with Moria and analyze with Mithril ⛏️💎

[Ben Sadeghipour @NahamSec]

Thrilled to welcome @OpenAI as another target for Prompt2Pwn, our live hacking event at #NahamCon2026! 🎯

Only a few in-person tickets remain. Apply for a free tickets 👉🏼 https://t.co/A4KGlaFWqM

[Matt Brown @nmatt0]

@0xTib3rius Claude port my app to latest PHP. Make no mistakes.

[Matt Brown @nmatt0]

Ppl in this thread are like "but that's illegal". Like, yeah we know.

[Marc Köhlbrugge @marckohlbrugge]

if this PHP vulnerability allows remote code execution, doesn't that mean we can use the vulnerability to auto-patch all vulnerable servers?

[solst/ICE of Astarte @IceSolst]

chatphp pls generate a single digit privkey with my distilled opencode api key, put it in a toilet paper roll behind the TV, and assign it CVE-2026-99999. Then reverse this French fridge’s firmware. Make no mistakes.

[Matt Brown @nmatt0]

@Rhynorater I think this is my new favorite 2spark model. faster than GLM 5.3 Flash for my workloads

[Matt Brown @nmatt0]

Benchmarking this now.

Open weights are pacing the frontier.

[Mia @MiaAI_lab]

DeepSeek V4.1 Flash 1017 on 2x DGX Sparks

Frontier at home. No limits. 100% Private.

https://t.co/p6Rs3NXdGP

[Matt Brown @nmatt0]

@iangcarroll or forever for IoT that trusts them...

[Matt Brown @nmatt0]

@LowLevelTweets PHP is the cockroach of the internet

[Matt Brown @nmatt0]

@IceSolst LOL should we have been scanning for this stuff??

[Matt Brown @nmatt0]

@0xConda It FAST. Idk if it's ZIG or what. Still benchmarking

[Matt Brown @nmatt0]

@compuficial @bot 's/bot/mind/'

[Matt Brown @nmatt0]

@0xTib3rius My dog wants to know if this means his treats are a business expense.

[Matt Brown @nmatt0]

I've found vulns exploitable over WiFi that were identifiable by SSID prefix...

One @wiglenet search is all you would need to geolocate a pwnable device.

[i²cjak @i2cjak]

less freaky and longer range: every WiFi SSID (well BSSID) is sniffed by smartphones and geotagged. Someone can look up your home network SSID and, if it is unique, exactly locate you. Or find a handful of places you might be. Your SSID is literally your address, treat it as such

[Matt Brown @nmatt0]

@iangcarroll If you think SW is bad look at some of the HW programs 🤣
The number of F500s with hardware products that have no bug bounty program or have max crits under $5k is insane.

[Will @realwillreil]

Just another day in the factory

[Hash @BitBangingBytes]

The $999 SEM is coming along